Write once recording is a means of securing information at a particular point in time, which information may be archived for future reference. Some recording media is inherently write once, such as “WORM” (write once, read many) optical disk media. As an example, WORM optical disk media may comprise a material which is ablated when written and is therefore not subject to being erased and overwritten by new information. It is, however, subject to being destroyed if an attempt is made to overwrite previously written information. Other examples of write once optical disk recording media comprise non-reversible phase change and dye polymer WORM optical disk media. Thus, checks, such as microcode interlocks in a write-once optical disk drive, are employed to insure that a portion of a WORM optical disk that has been written is not overwritten and destroyed. Although the information may be destroyed, such as by ablating or distorting the media, the optical disk cannot be tampered with to alter the information by one with normal user resources.
By contrast, some media, such as magnetic tape, is inherently rewritable in that prior information can be erased and overwritten by new information. Various “write protect” devices are often employed to theoretically protect written data on the inherently rewritable media from being erased or overwritten. One example comprises the write protect tab on audio cassettes and video tape cartridges which may be broken off to expose an opening that is sensed by the tape drive which then prevents erasure or overwriting the tape. Another example is the write protect thumb wheel or slide on magnetic tape cartridges, such as the IBM 3590 magnetic tape cartridge, which may be rotated or repositioned to a write protect position. The position of the wheel or slide is detected by a tape data storage drive in which the cartridge is loaded. An example of a write protect sliding notch is illustrated in U.S. Pat. No. 6,134,066. The device disclosed in the patent allows a cartridge memory to be updated even though the cartridge media itself is write protected. Still another approach is to provide a write prevention flag recorded in a tape information area of the tape, such as illustrated in U.S. Pat. No. 5,493,455.
However, should someone wish to tamper with the cartridge and media to alter the data, a covering may be placed over the write protect opening, or the write protect thumb wheel or slide may simply be rotated or repositioned away from the write protect position. Further, a data storage drive may be operated to reset a write prevention flag off. Thus, someone with normal user resources and an intention of erasing or altering data may easily do so, and then may again set the write protect back to the protected position or state, leaving an impression that the original data remains intact.
Another possibility is to provide write once cartridges that have special mechanical aspects which interface with specially designed data storage drives. Although it is more difficult to alter such a cartridge to become read/write, such cartridges must be separately maintained for identification and used only in the instance that the data to be stored is desired to be stored in a write once cartridge. As the result, such write once cartridges are less convenient for a user in a mixed cartridge environment.
The protections afforded by the above-described methods may be bypassed with relative ease. And, in fact, it may even be possible to alter recorded data and reset the protection, thereby leaving the data appearing to be original. A more advanced option provides an increased level of security and is described in commonly-assigned and co-pending U.S. application Ser. No. 10/440,694, filed May 19, 2003 and incorporated herein by reference in its entirety. A cartridge handling system and method initialize a data storage cartridge having rewritable media and a cartridge memory for tamper resistant write once recording. A write-once flag is written to a lockable section of the cartridge memory which also stores a cartridge memory serial number. Once the flag is written, the section is locked to be read-only. A write-once flag and the serial number are also written to a required data set of the rewritable media. Thus, both appear in both locations of the cartridge. In a further embodiment, the rewritable media has a prerecorded media identifier which is written to the cartridge memory along with the write once flag. Any attempt to rewrite data is said to be prevented because the write once flag and serial number are stored in both locations. Any attempt to alter the cartridge memory, move the media or copy its contents to another cartridge is also said to be prevented because the cartridge serial number in the cartridge memory would be different from that recorded to the media.
While the forgoing method decreases the risk of tampering, a risk still remains. First, a write once flag may be altered. Second, it may be possible to replace the cartridge memory of an initialized cartridge with an uninitialized cartridge memory. If the cartridge is then inserted into a drive after read circuits have been tampered with, the drive may determine that the cartridge is an uninitialized WORM cartridge and overwrite data on the cartridge.
Consequently, a need remains for improving the tamper-resistance of re-writable media written in a write once format.